AutoGPT Vulnerable to OS Command Injection Due to Flaw in Shell Command Validation Function

CVE-2024-1881

What is CVE-2024-1881?

AutoGPT, developed by Significant Gravitas, has a security vulnerability that enables OS command injection due to the application's inadequate validation of shell commands. This flaw resides in versions from v0.5.0 up to but not including v5.1.0. The root of the issue is found in the command validation mechanism, which only reviews the first word of the shell command against an incomplete allowlist. As a result, attackers can exploit this gap by constructing commands that circumvent these restrictions, potentially leading to the execution of arbitrary commands on the operating system level. Such a capability poses considerable risks to system integrity and security, making it imperative for users to address this vulnerability promptly to safeguard their environments.

References